CVE-2026-30942 Flare has a Path Traversal in /api/avatars/[filename]
An authenticated path traversal in Flare allows attackers to read arbitrary files from the server, requiring only a logged-in account which can be self-registered by default.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30942?
CVE-2026-30942 is a high-severity path traversal vulnerability in FlintSH Flare, published on 10 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to 1.7.3, an authenticated path traversal vulnerability in /api/avatars/[filename] allows any logged-in user to read arbitrary files from within the application container. The filename URL parameter is passed to path.join() without sanitization, and getFileStream() performs no path validation, enabling %2F-encoded ../ sequences to escape the uploads/avatars/ directory and read any file accessible to the nextjs process under /app/. Authentication is enforced by Next.js middleware. However, on instances with open registration enabled (the default), any attacker can self-register and immediately exploit this. This vulnerability is fixed in 1.7.3.
Weakness: CWE-22
Which versions are affected by CVE-2026-30942?
It affects 1 product.
Products include Flintsh Flare.
How do I fix CVE-2026-30942?
No fix has been published for CVE-2026-30942 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-30942 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30942 exists.
Other vulnerabilities in FlintSH Flare
Sources
Also known as GHSA-h639-p7m9-mpgp.